twitter-watch

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/watch.py invokes external commands using subprocess.run to interact with the agent-browser CLI and verify the presence of npm. On Windows systems, it employs shell=True to ensure compatible command resolution within the shell environment.\n- [PERSISTENCE]: The skill programmatically updates the ~/.agent-browser/config.json configuration file to set autoConnect: true. This modification is intended to ensure that the automation tool consistently recognizes and connects to the user's active browser session during subsequent runs.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by ingesting external data from user-provided files and scraping content from live Twitter web pages.\n
  • Ingestion points: The agent reads tweet links from a user-specified text file (links.txt) and extracts interaction data (likes, retweets, etc.) from the HTML content of Twitter pages.\n
  • Boundary markers: Explicit boundary markers or instructions to ignore embedded commands are not utilized, as the data processing is performed by a specialized Python script rather than being directly interpolated into an LLM prompt.\n
  • Capability inventory: The skill possesses capabilities to execute shell commands, write to the local file system (for reports and configuration), and perform network operations via the controlled browser.\n
  • Sanitization: The script implements regex-based extraction for tweet IDs and interaction metrics, effectively filtering out non-numerical content and limiting the risk of malicious text influencing the application logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:51 PM